Every Binions release is checked for dependency vulnerabilities before it ever reaches your host. The platform is built as a single, pure-Rust workspace with its dependencies pinned in one central place, and no build ships until it has cleared a set of automated security gates. This page explains what those gates check and what it means for you as an operator.
Why it matters. Because vulnerable or unwanted dependencies are caught at build time, the main thing you need to do is stay current. Keeping the platform updated with
apt upgradeis how the fixes reach your machine.
Binions is written entirely in Rust and organised as a single Cargo workspace — one project tree that builds all 13 daemons together. Crucially, the third-party libraries (Rust calls them crates) that Binions depends on are pinned centrally, so every daemon uses the same, known versions rather than each pulling its own.
That single-workspace design has a direct security benefit: there is exactly one place where a dependency is declared and one place to update it. When a library needs a security fix, it is bumped once and every daemon inherits the corrected version on the next build. There are no scattered, drifting copies of a vulnerable crate hiding in a corner of the codebase.
A release is only published after it clears a set of automated checks during continuous integration (CI). If any gate fails, the build does not ship. Three of those gates are specifically about the dependency supply chain:
cargo-deny — vulnerability, licence, and source policy. It compares every dependency against the RUSTSEC advisory database, the Rust ecosystem’s public record of known-vulnerable crates. A dependency with an open advisory fails the build. The same gate also enforces a licence policy (only approved open-source licences are allowed) and a source policy (dependencies must come from trusted, expected origins).cargo-machete — unused-dependency hygiene. It flags libraries that are declared but no longer actually used. Removing dead dependencies keeps the overall dependency surface — and therefore the attack surface — as small as possible.Good to know. These checks run before a release is built into a package, not on your host. By the time a version is available to install, it has already passed all of them — there is nothing for you to run or configure.
Binions is built on the stable Rust release channel — not a nightly or experimental build — with a minimum supported Rust version of 1.95. Pinning to a stable, known-minimum toolchain means builds are reproducible and predictable, and avoids depending on unstable compiler features that could change underneath the platform.
| Language | Pure Rust, one Cargo workspace |
| Dependencies | Pinned centrally; checked against RUSTSEC by cargo-deny |
| Unused-dependency check | cargo-machete keeps the dependency surface minimal |
| Bus-contract check | AsyncAPI diff gate — no silent contract changes |
| Toolchain | Stable Rust channel, minimum supported version 1.95 |
You do not run any of these gates yourself — they are part of how each release is produced. The practical takeaway is simple: dependency vulnerabilities are caught at build time, so the fixes arrive through normal updates. Keep your host current with the standard package upgrade flow:
sudo apt update
sudo apt upgradeTip. Treat upgrades as part of your security routine, not just feature maintenance. When a dependency advisory is addressed in a new release, applying that release is how the fix reaches your installation.